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We develop a theory for long-distance quantum key distribution based on concatenated entan¬ 
glement swapping using parametric down-conversion sources and show numerical results of our 
model. The model incorporates practical resources including multi-pair sources, inefficient detec¬ 
tors with dark counts and lossy channels. We calculate the maximum secret key-generation rate 
for up to three entanglement swapping stations by optimizing over resource parameters, and our 
numerical simulation shows that the range of quantum key distribution can in principle be markedly 
increased but at the expense of an atrociously unfeasible secret key-generation rate; however, the 
upper bound of our key rates closely approach the Takeoka-Guha-Wilde upper bound. Our analysis 
demonstrates the need for new technology such as quantum memory to synchronize photons and 
our methods should serve as a valuable component for accurately modelling quantum-memory-based 
long-distance quantum key distribution. 


I. INTRODUCTION 

Secure communication over public channels is vital for 
enabling effectively private information transfer. Two 
steps are involved: establishing a key and then using the 
key for encryption and decryption |l|. The security of ex¬ 
isting approaches to constructing a shared key between 
two parties relies on the computational complexity of the 
secret-key-generation algorithm, but this security would 
be compromised if fast decryption algorithm were discov¬ 
ered (unlikely but not provably forbidden) or if a scalable 
quantum computer were available. Quantum key distri¬ 
bution (QKD) aims to provide information-theoretic se¬ 
curity, in other words to create keys that are safe against 
computational attacks Q. 

One key challenge for QKD is to reach long dis¬ 
tances, which practically means extending beyond hun¬ 
dreds of kilometres with a good secret key-generation rate 
(SKGR) (better than kilobits per second) and low error 
rates, with less than 11% to be corrected by one way 
classical communication Q. Two distinct approaches 
to QKD exist: one protocol relies on one party send¬ 
ing qubits to the other, exemplified by the 1984 Bennett- 
Brassard (BB84) protocol [jj , and the other based on the 
two parties sharing and reconciling an entangled state ex¬ 
emplified by the 1991 Ekert fE91) [H[ and 1992 Bennett- 
Brassard-Mermin (BBM92) p] protocols. 

The BBM92 protocol is particularly amenable to the 
quantum relay method [7j], which relies on entangle¬ 
ment swapping (ES) Q to extend the distance QKD can 
reach [||. Our theory treats practical QKD, where the 
term “practical” refers to the theory accommodating the 


reality of photon sources and detectors including multi¬ 
photon events, dark counts and losses aim 

Here we study the reach of practical quantum-relay- 
based long-distance QKD using a theory that treats pho¬ 
ton sources, communication channels and detectors real¬ 
istically. Our model shows that QKD could reach over 
800 km in principle but at atrociously bad SKGR. An 
important result of our theory is the underscoring of the 
need for quantum memory [llj, [12J to synchronize pho¬ 
tons so that the poor rates obtained from our analysis 
can be beaten, and our model will prove valuable as a 
component of a full, accurate model that incorporates 
realistic quantum memory in order to assess the reach of 
quantum-repeater-based QKD [l3] . 

We develop our model of long-distance QKD by ex¬ 
tending an existing practical protocol that modifies the 
BBM92 protocol using ES. This practical protocol, which 
is based on parametric down conversion (PDC) sources is 
given the acronym PDC-ES-BBM92 [l4j j. Our modifica¬ 
tion here extends PDC-ES-BBM92, which we call PDC- 
CES-BBM92, to the case of multiple ES stations by em¬ 
ploying concatenated ES, or CES for short. The earlier 
protocol PDC-ES-BBM92 is a special case of PDC-CES- 
BBM92 corresponding to having a single ES station. This 
special case corresponds to non-relay setup, with which 
we will compare our relay setups. 

If a source were capable of producing a train of ideal 
Fourier-limited single photons [l5j], the BBM92 protocol 
would straightforwardly accommodate multiple repeater 
stations. For practical QKD, which accounts for im¬ 
perfect sources and detectors, the protocol for sender A 
and receiver B must dictate actions for cases that higher 


2 


counts are received as described in the PDC-ES-BBM92 
protocol. The security of PDC-ES-BBM92 is assured 
through squashing, with squashing referring to the effec¬ 
tive projection of the protocol’s Hilbert space to smaller 
dimension through the measurements conducted by A 

and B [3113. 

For TV = 3 ES stations, we show that our model pre¬ 
dicts a secure communication distance of up to 850 km. 
Unfortunately the rate becomes unimaginably low: even 
at zero separation between A and B, and simply taking 
into account just the device losses and the coincidence 
probability for the various PDC sources, one bit would 
be generated every 150 billion years, which is approxi¬ 
mately ten times the presumed age of the universe. Hav¬ 
ing A and B move far apart makes the rate even worse 
due to channel losses between PDC-based ES stations. 
The pessimistic predictions of our model do not negate 
the value of having a realistic ES-based QKD descrip¬ 
tion; rather such a model is needed as a foundation for 
accurate descriptions of ultimately feasible long-distance 
QKD. 

As our protocol performs badly with respect to SKGR, 
we evaluate how well PDC-CES-BBM92 performs with 
respect to the Takeoka-Guha-Wilde (TGW) bound for 
SKGR 0. We Thus, determine the SKGR consider¬ 
ing ideal single-photon sources and unit-efficiency zero- 
dark-count detectors thereby ensuring that our protocol 
is limited only by channel loss and concatenations. The 
resultant idealized SKGR for our protocol is only slightly 
below the TGW bound, which depends solely on channel 
loss regardless of optical power. Thus, our protocol is 
reaching close to an bound for protocols that do not use 
quantum repeaters. 

The paper is organized as follows. In Sec. El we briefly 
explain the resources used in entanglement-based proto¬ 
cols. We provide a brief account of BBM92 and PDC- 
ES-BBM92 protocols and SKGR associated with these 
protocols, and we discuss the SKGR TGW upper bound 
for non-repeater-based QKD protocols. In Sec. nm we 
describe in detail the protocol for evaluating visibility. 

In Sec. m we explicate how the quantum-bit-error 
rate (QBER) and the key rate are calculated. We de¬ 
termine optimal parameter choices for maximizing the 
SKGR, and provide these optimal resource parameters 
in Sec. We present and plot our results for N = 2 
and N = 3 stations for PDC-CES-BBM92 protocol. We 
compare our PDC-CES-BBM92 protocol with the decoy- 
state protocol, and we find the SKGR upper bound for 
our protocol and compare it with TGW bound. Finally, 
we conclude in Sec. eh 


II. BACKGROUND 

In this section, we provide a background on the 
imperfections of the optical resources as well as de¬ 
scribing existing entanglement-based protocols on which 
our PDC-CES-BBM92 protocol is based. Specifically 


these protocols comprise the BBM92 protocol and the 
PDC-ES-BBM92 protocol, which are special cases of 
our new protocol. We also provide a brief account of 
the measurement-device-independent decoy-state proto¬ 
col, which extends furthest among the protocols studied 
Thus, far. Finally we assess the TGW bound applicable 
for any QKD protocol not using quantum repeaters. 

We consider PDC sources with photon-pair production 
rate x 2 - The state of each PDC source can be represented 
by the pure state 


lx) = exp 



(1) 


with a and b the annihilation operators for the two spatial 
modes with two polarizations {H,V}, and he denoting 
Hermitian conjugate. 

We consider threshold detectors with efficiency rj and 
dark-count probability p. Highly-efficient detectors are 
desirable for long-distance QKD, but, in practice, effi¬ 
ciency is traded against increasing dark counts. For com¬ 
monly used InGaAs detectors this trade off is 

P = Ae B \ (2) 

with typical values [j] 

A = 6.1 x 10” 7 , B = 17. (3) 


A more efficient detector will, in turn, have a higher dark- 
count rate. 

Ineficiency accounting for detector inefficiency ry plus 
channel losses is 


lO-(aGao)/ 10 ^ 


( 4 ) 


for i the length of channel between the source, and the 
detector. The loss coefficient is a, which is given in units 
of dB/km, and a fixed loss parameter ao incorporates all 
other distance-independent losses. 

For the BBM92 protocol Q based on perfect resources, 
the two legitimate users (sender A and receiver B) share 
an entangled pair of qubits. They measure the states of 
their own qubit in one of two bases, chosen randomly. 
Subsequently A and B reconcile a posteriori their data 
strings by selecting those cases for which basis choices 
were identical. Ultimately they obtain a shared set of 
random numbers from which they build a key, and they 
use privacy amplification to ensure that messages can be 
sent securely from A to B. 

The ES-BBM92 protocol modifies the BBM92 protocol 
by using entanglement swapping to distribute entangle¬ 
ment between two users who have never interacted. Each 
of the two legitimate users have a source producing an 
entangled pair of photons in two modes. A Bell state 
measurement (BSM) is performed on two modes, with 
one mode emanating from each of the two-mode sources. 

A singlet state is post-selected after the BSM. The sin¬ 
glet state is just one of the four Bell states 


|$±) := |$±) := l Q1 > ± l 10 >) 

\/2 \[2 


( 5 ) 
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(with |0) and |1) the logical qubit in the off and on 
states, respectively). The ideal singlet measurement cor¬ 
responds to the projector ('h _ |. If the initial source 
is a perfect single-pair source, then the post-selection at 
the BSM projects the state of the remaining two modes 
into a singlet state. Since the two users now share entan¬ 
gled state, BBM92 protocol can be applied. 

In the realistic scenario of PDC-ES-BBM92 [IJ, PDC 
sources are used and the detectors and channels have im¬ 
perfections discussed above. The extent of entanglement 
shared between the two users is quantified by measuring 
the visibility V of multi-photon coincidences between the 
two legitimate users. 

As the measurement-device-independent decoy-state 
protocol 0, 0 has Thus, far the maximum reported 
achievable distance, we compare the distance achieved 
by our PDC-CES-BBM92 protocol with that achieved 
by the measurement-device-independent decoy-state pro¬ 
tocol, which is a variant of the earlier decoy-state proto¬ 
col [III • In the decoy-state protocol, decoy pulses supple¬ 
ment signal pulses to detect adversarial attacks. In the 
measurement-device-independent protocol, signal pulses 
are sent by the two legitimate users to the untrusted ad¬ 
versary and the post selection is done on the basis of 
measurement results of the adversary. The measurement 
results of the decoy pulses are used to estimate the error 
rate of the single photon pulses. 

TGW establish an upper bound on SKGR for non- 
repeater-based protocols E3- Specifically TGW show 
that, regardless of the optical power, the SKGR upper 
bound, 

1 _|_ io~ ai/1 ° 

Rtgw = log 2 11Q _ ae/10 , (6) 

varies solely with channel length l. According to 
this bound, any non-repeater-based QKD protocol with 
SKGR exceeding i?TGW is insecure. 

III. EVALUATING VISIBILITY 

The QKD protocol depends on sufficient visibility of 
multi-photon coincidences between the two parties A 
and B separated by distance l who are connected by a 
quantum and a classical channel as shown in Fig. [I] Here 
N = 1 corresponds to the single swap non-relay setup. 
In this section we explain clearly how visibility should be 
evaluated for a CES scheme. Although the concepts are 
known in the community, our explanation in this section 
is valuable because each aspect of the protocol for vis¬ 
ibility needs to be clear to establish the QKD protocol 
based on CES and to determine the protocol’s security. 

The coordinate extending from A at the origin to B 
is denoted x. To achieve long-distance QKD, alternat¬ 
ing, periodically-spaced PDC sources and measurement 
stations enable concatenated entanglement swapping so 
that A and B can achieve shared entanglement despite 
photon losses en route. 


Classical channels 

FIG. 1: Two parties A and B, separated by length l, are con¬ 
nected by two channels: one quantum and the other classical. 
Alternating parametric down conversion (PDC) sources □ and 
measurement stations o periodically adjoin the channels. Two 
PDC sources and one measurement station comprise an en¬ 
tanglement swapping setup. For a total of N swapping setups, 
for x denoting the spatial coordinate from A at x = 0 to B at 
x = £, measurement stations are located at each x = ££/(2N) 
for £ € {1, 2,..., 2 N — 1}, and PDC sources are located at 
each x = (2£ + 1)£/2N for £ € {0,1, 2,. .., N — 1}. Insets: A 
and B each have a polarizing beam splitters (PBS) to split the 
incoming beam into separate spatial modes for each polariza¬ 
tion component, and a threshold detector for each of the two 
polarizations. B also has constructs a record of measurement 
events obtained by A, by all measurement stations, and by 
himself. Each measurement station comprises a beam splitter 
(BS), two PBSs, and four threshold photon counters. 


The quantum channel is a medium, such as an optical 
fiber, which is transport to light and allows superposi¬ 
tions of photon number and of polarizations to propa¬ 
gate non-negligible distances. We treat the channel as 
having a spatially homogeneous loss rate, and we neglect 
decoherence in the polarization basis. The classical chan¬ 
nel allows A and measurement stations to transmit their 
measurement results to B so this channel can be oneway. 

Each PDC source generates two entangled beams, one 
propagating leftward (negative x direction) and the other 
propagating rightward (positive x direction). The light 
is picked up by a measurement station or by A or by B. 
A and each measurement station transmit measurement 
results plus a time tag indicating the time of measure¬ 
ment through the classical channel to B, who uses these 
data to infer the photon-coincidence visibility V. 

Photodetection is achieved by employing threshold 
photon counters, which in the ideal case clicks only when 
at least one photon arrives and does not click only when 
no photon is incident on the counter. A detector click is 
sent to B through the classical channel. Due to detector 
inefficiency, an incident photon might not cause a click, 
and, due to dark counts, the detector might click even if 
no signal photon has arrived. 

As shown in an inset of Fig. [T| each measurement 
station has a beam splitter (BS), which accepts at its 
two input ports the leftward beam from the neighboring 
PDC source on the right and the rightward beam from 
the neighboring PDC source on the left. The two out¬ 
put beams are each directed to a polarizing beam split¬ 
ter (PBS) to separate the two polarizations into distinct 
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spatial modes, and these spatial modes are directed to 
four separate threshold photon counters: two detectors 
on each side (left and right) to register photons in the 
horizontal (H) and vertical (V) polarizations. 

Also shown in the insets of Fig. [Q A has a single incom¬ 
ing beam from the right, which she splits into two using 
a PBS and sends to two detectors. B has the same set-up 
as A but additionally keeps a record of measurement data 
transmitted to him by A and each measurement station. 

One or more detectors at a measurement station can 
click at any time. When at least one detector clicks on 
each side (left and right), the measurement station trans¬ 
mits to B the time of the click and a binary signal indi¬ 
cating which detectors clicked. As the measurement sta¬ 
tion hosts four detectors, and each detector can click or 
not click at a given time, eight possible detection events 
can occur at any time. As at least one detector on each 
side (left and right) must click, then the number of pos¬ 
sible detection events reduces to seven possible recorded 
events. The measurement station Thus, transmits to B 
the time of the event and which possible outcome oc¬ 
curred. 

B collects all results and then creates time bins of short 
duration. A detector click is stored as ‘1’ and no click as 
‘O’, and the bit is stored in the corresponding time bin. 
The results from a station in one time bin Thus, form 
a four-bit string with the first two bits allocated for H 
and V detectors on the left and the last two for H and V 
detectors on the right. 

The measurement results from A and B in one time 
bin are stored as a two-bit string from H and V detectors. 
B post-selects those time bins in which measurement re¬ 
sults from each station are anti correlated, implying a 
click in the H detector on left and a click in V on right 
and vice versa, which corresponds to string 1010 or 0110. 

For these post-selected time bins, represented as lists, 
B counts the coincidences in his and A’s bit strings such 
that A’s string is 10 and his string is 01 or vice a versa. 
The number of all such coincidences is represented by 
the quantity ‘max’, as these events correspond to the 
maximum coincidences. Minimum coincidences in the 
post-selected time bins occur when A’s and B’s strings 
are correlated. This correlation implies detection event 
10 or 01 at both occurred. The number of all such time 
bins is recorded as ‘min’. All the rest of the values in the 
time bins are discarded. 

B calculates the visibility according to 


max + min 

Alternatively, instead of discarding events 11 at any 
pair of detectors, B could assign randomly either 01 
or 10 to each 11 event. The motivation for this proce¬ 
dure is to map higher-dimensional events, due to multi¬ 
photon occurrences, to a lower-dimensional space rather 
than just discard higher-dimensional events. This assign¬ 
ment of higher-photon occurrences to lower-photon re¬ 
sults is preferable for security as this procedure enables 


the quashing map [2ll . [22ll . A closed-form solution for co¬ 
incidence probability J23( is provided in Appendix 1X1 

IV. QUANTUM BIT ERROR RATE AND 
KEY-GENERATION RATE 

The two figures of merit for QKD are QBER ( Q ) and 
SKGR ( R ). We begin with a brief account of both as 
they relate to BBM92 and PDC-ES-BBM92 protocols. 
QBER Q is the ratio of wrong bits to the total number 
of bits exchanged between the legitimate users, and Q 
can be calculated from V according to 0 

L - V 

Q = ~2~- ( 8 ) 

The SKGR R is the ratio of bits retained between the 
legitimate users at the end of the QKD procedure to 
the bits sent originally and serves as the figure of merit 
for achieving successful QKD. This rate depends on two 
terms. One is the sifted-key rate R sl f for events corre¬ 
sponding to A and B choosing the same bases. 

The second term is the Shor-Preskill bound 

R sp = 1-kH 2 (Q)-H 2 (Q) (9) 

arising from optimal error correction and privacy ampli¬ 
fication Q with 

H 2 {Q) ■■= ~Q log 2 Q-{l-Q) log 2 (l - Q) (10) 

being the Shannon entropy. The term kH 2 is the lost-bit 
rate due to error correction, with re being the reconcilia¬ 
tion efficiency and re = 1 for perfect reconciliation. The 
SKGR is the product 

R = -Rsif-Rsp, ( 11 ) 

which is approximately half the raw SKGR. 

For PDC-ES-BBM92, R s if depends on four factors: 

1. each PDC source should successfully emit an en¬ 
tangled pair of photons; 

2. the photons from each source should reach the BSM 
set up; 

3. the BSM should be successful; and 

4. the photons created at the two ends of the line must 
be detected by A and B. 

For perfect reconciliation, re = 1. The second term 
H 2 corresponds to key bits lost in privacy amplification. 
Above a certain cutoff (co) QBER denoted Q c 0 (re), the 
rate bound Rsp and hence the rate R are no longer pos¬ 
itive. From Eq. <[9|), we can determine that 

Q co (re = 1) = 0.11, Q co (re = 1.22) = 0.094. (12) 

We denote the maximum value of distance for which R 
is positive by £ max . 
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The lower bound of Rsp © assumes perfect sources. 
However, Koashi and Preskill [24j proved that the same 
bound is valid for any defect in the source as long as 
the defects do not reveal basis choice by legitimate users 
to the omnipotent eavesdropper. This assumption holds 
even if a third party controls the source. 

The rate bound is derived for qubits. In a real¬ 
istic setup, measurements are made on multi-photon 
states, which span an infinite-dimensional Hilbert space. 
The squashing techniques enables all measurements to 
be reduced to statistically equivalent measurements on 
qubits fl7| . 

Through squashing, the incoming signal is first 
mapped (squashed) to a two-dimensional Hilbert space 
whose physical state is a single-photon polarization. The 
measurement is Thus, effectively performed on the single¬ 
qubit Hilbert space. If the detection device is trusted and 
fully characterized, then the squashing map can become 
part of the eavesdropper’s attack. Therefore, the lower 
bound is the same as given by Eq. ©, and all the devia¬ 
tions from perfect two photon source are accommodated 
by measuring the QBER [24[. 

In order to calculate R s if in Eq. ED. we calculate the 
four factors, which comprise raw SKGR for our set up: 

1. Each PDC source successfully emits an entangled 
pair of photons with probability (x 2 ) 2JV ; 

2. the photons from each source reach the BSM set 
up with probability io(-“V40AT)4JV. 

3. the BSM is successful with probability ?y 2 /2 
bounded by its maximum value of 1/2 ©I so 
the net probability of 2N — 1 successful BSM is 
(rj 2 /2) 2N ~ 1 ; and 

4. the photons at the two ends reach A and B with 
probability rj 2 . 

Thus, R s \{ is 

R si{ = |(x 2 ) 2Ar 10 ( -“ i/40Ar)4JV (r 7 2 /2) 2Ar - 1 r 7 2 . (13) 

The sifted-key rate decreases exponentially with increase 
in number of stations, N. R is then calculated from 
Eq. (fill) using Eqs. © and (fl3l) . 

The SKGR for ideal resources, Rideab is determined by 
treating perfect single-photon sources and perfect unit- 
efficiency zero-dark-count detectors for which V = 1. 
Therefore, Rsp = 1 so Eq. ED shows that the sifted- 
key rate, R s n with r/ = 1, is the sole contributor to the 
SKGR according to 

flideal = Rsif = 2- 2N 10~ a * /10 , (14) 

which must be less than the TGW bound ©. 




FIG. 2: QBER vs y: QBER is plotted vs (a) source efficiency 
( x ) and (b) distance (£) for N = 1 (dotted curve), N = 2 (dot- 
dashed curve) and N = 3 (solid curve). Detector efficiency is 
set at rj = 0.4 and dark count efficiency is p = 1 x 1CP 5 . 


V. MAXIMIZING THE KEY RATE 


One goal of successful QKD is to maximize R for as 
large a distance as possible. We have seen that, in the 
case of the PDC-CES-BBM92 protocol, R depends on 
various resource parameters. 

Most importantly R s if and R$p depend differently 
on x; whereas R sl i decreases exponentially on decreas¬ 
ing x , a low value of \ is needed to maximize Rsp- Both 
factors require low p and high 77 to be maximized. We 
use numerical optimization technique to find the max¬ 
imum value of R , R max , as a function of the resource 
parameters. 

In Subsec. IV A1 we analyze the dependence of QBER 
on PDC source efficiency Then, in Subsec. IVBl we ob¬ 
tain I? max over multiple resource parameters. We present 
and plot our numerical results for N = 2 and N = 3 and 
compare them with the known results of N = 1. We 
also compare our protocol with the decoy-state proto¬ 
col and compare the idealized maximum key rate with 
the TGW bound. 
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A. Dependence of QBER on resources 

QBER depends on V of the setup and hence in turn 
depends on all resource parameters. We calculate V [Hj 
and analyze the dependence on source efficiency y i n 
Fig. 0a) for one, two and three stations, which are la¬ 
beled IV = 1, 2 and 3 respectively. In order to maintain 
the QBER below Q co , y needs to be maintained below 
0.20 for TV = 1, below 0.08 for TV = 2 and below 0.05 for 
TV = 3. 

In seeking high R , QBER is not the only influencing 
factor. Sifted SKGR R s if increases for higher values of y 
as shown in Eq. m • Thus, a tradeoff is needed be¬ 
tween the two rates. To this end, we find optimal y, 
namely y op t, in order to obtain i? max as described in 
Subsec. IV Bl 

Another point of interest is to be able to achieve as long 
distance as possible with low QBER. We analyze how Q 
varies with distance for different numbers of concatena¬ 
tions. Figure 0b) shows the variation with distance up 
to the threshold Q co of 0.11. To obtain R max , Q must 
be constrained within the range shown for each selected 
distance Z. 


B. Maximum R 

We obtain R max for various resource parameters. 
These parameters include source brightness y , the de¬ 
tector intrinsic efficiency rj and detector dark counts, but 
we only maximize R over two parameters y and rj as p 
is constrained 0. The two parts of R , namely R sl i and 
Rsp, depend in different ways upon y and rj. Whereas 
maximizing R s a requires keeping y high, maximizing Rsp 
requires y to be low. For low y, dark counts become 
more pronounced; hence detector efficiency should be 
kept small in order to have low dark count rate. 

To obtain R m ax , we employ a multi-dimensional 
optimization technique, specifically the quasi-Newton 
method, over two parameters. An appropriate initial 
point needs to be provided so that the search for i? max 
commences with a positive value of R for each distance. 
Prior information about Q obtained in Subsec. IV Al is 
important. 

The maximized R obtained after optimizing over the 
two parameters y and r;, i.e., determining y opt and ry opt 
is shown in Fig. 0a) for TV = 1, TV = 2 and TV = 3. 
The loss coefficient is set at a = 0.25 dB/km, constant 
loss at a 0 = 4 dB and n = 1.22 |26j. The optimization 
procedure requires calculating R many times, which is 
computationally expensive. 

We observe a cutoff distance Z max ~ 350 km for 
TV = 1. For TV = 2 is Z max ~ 600 km and, for TV = 3, 
<max ~ 850 km. For larger distances, we failed to obtain a 
positive value of R despite searching a wide swathe of pa¬ 
rameters y and rj. As can be seen from the plots, TV = 3 
should only be selected if TV = 2 and TV = 1 choices for 
concatenation fail. 



/(km) 



FIG. 3: Plot of (a) logi? max , (b) y 0 pt and (c) r / op t vs dis¬ 
tance l up to maximum Z m ax for N = 1 (dotted), N = 2 
(dot-dashed) and N = 3 (solid) for a = 0.25 dB/km and 
ao = 4 dB. Symbols ■, • and ♦ represent numerically deter¬ 
mined data points, which are connected by straight lines. 


The values for y opt and rj opt that yield i? max in 
Fig. da) are presented in Figs. 0b ,c) for the cases 
TV = 1,2, 3. As distance increases, Q co can become small 
if y is also small. However, low values of y in turn re¬ 
quire use of detectors with low efficiency in order to keep 
the dark count rate small. This requirement is also clear 
from comparing the slopes of curves for y opt and r) opt . 
The optimal y does not decrease for TV = 2 or for TV = 3 
as rapidly as it does for TV = 1. 

The maximum R obtained here is far too low for prac- 











7 



FIG. 4: Plot of logi? max for optimal \ for SNSPD with 
efficiency 93% and dark count probability 10~ 9 for N = 1 
(dotted) and N = 2 (dot-dashed). 


FIG. 5: Logarithmic plot of PDC-CES-BBM92 upper bound 
of R for N = 1 (dashed curve), N = 2 (dotted curve), and 
N = 3 (dot-dashed) for PDC-CES-BBM92 compared with 
the TGW bound (solid curve) for various distances l. 


tical purposes. Even for perfect detectors with unit ef¬ 
ficiency and zero dark counts, a low value of \ is re¬ 
quired to keep the QBER below Q co . This condition 
yields a maximum value of R corresponding to 1 bit each 
10 msec for optimal Xopt = 0.2 for a source with repe¬ 
tition rate 100 MHz at zero distance. The correspond¬ 
ing rate for N = 2 is one bit each 27.7 hrs for optimal 
choices x = 0.1. For N = 3 each bit requires waiting on 
average a mind boggling three million centuries for opti¬ 
mal choice x = 0.07. These sobering results emphasize 
the need to employ quantum memories 0,111 or another 
protocol to increase R to practical rates, and our theory 
serves as an important first step towards such accurate 
modeling. 

In comparison with our protocol, the measurement- 
device-independent (MDI) decoy-state protocol (20] 
yields a communication distance of around 367 km with 
detector efficiency of 14%. Even for detector efficiency of 
93% and dark count probability of 10 -6 , the achievable 
distance is 667km with a PDC source in the middle. For 
fair comparison we find the maximized key generation 
rate for Superconducting Nanowire Single Photon Detec¬ 
tors (SNSPD) with high detector efficiency 93% and low 
dark count rate 10 -9 (2?}, for our PDC-CES-BBM92 pro¬ 
tocol with N = 2 concatenations in Fig. [I] The achiev¬ 
able distance already reaches around 2000km, compared 
to around 800 km of MDI-QKD for the same parame¬ 
ters [28|. Though the MDI protocol yields higher key 
rates than our PDC-CES-BBM92 protocol and reaches 
much larger distance than BB84 protocol, the achievable 
distance is much less than that achieved by PDC-CES- 
BBM92 protocol. Eventually the low PDC-CES-BBM92 
key rate could be mitigated by incorporating quantum 
memory in a quantum-repeater setup. 

In that case, which is the subject of future work, such 
a quantum-repeater-based protocol could be superior to 
the decoy-state method for long-distance QKD. 

The idealized key rate i?ideai (ITU) for our PDC-CES- 
BBM92 protocol for N = 1,2,3 for various distances are 


compared with the TGW bound © in Fig. [5] with loss 
coefficient a = 0.25 db/km. These idealized key rates for 
our protocol are below the TGW bound as expected; yet 
they are quite close to the TGW bound as well, which 
reiterates our earlier perception of necessity of including 
quantum memories for any further improvement in R. 
Multimode memories tend to compensate for low pair 
emission rate and hence lower key generation rate [29( 
Although our theory is developed for arbitrarily many 
CES stations, the exponentially increasing computa¬ 
tional time with increasing number of concatenations ef¬ 
fectively limits our numerical analysis to N < 3 CES 
stations. 


VI. CONCLUSIONS 

We have studied a long-distance quantum key dis¬ 
tribution protocol that employs concatenated entangle¬ 
ment swapping (CES) using parametric down conver¬ 
sion (PDC) sources. Our model of this PDC-CES- 
BBM92 protocol accounts for realistic phenomena includ¬ 
ing multi-pair events, inefficient detectors, dark counts, 
and lossy channels. In particular, we have solved numeri¬ 
cally for N = 2 and N = 3 concatenations and compared 
these results with known results for the previously solved 
N = 1 non-relay entanglement-swapping setup. 

Through our model and numerical methods, we have 
determined optimal choices of resource parameters in¬ 
cluding source efficiency, detector dark-count rate, and 
detector efficiency so that these choices maximize the se¬ 
cret key-generation rate R. We have compared our re¬ 
sults with the popular decoy-state protocol, which is a 
promising long-distance QKD protocol. The key rate for 
perfect resources in our protocol are compared to the 
TGW bound, which is the upper bound for any QKD 
protocol not involving quantum memories. 

Our results show that secure key distribution distance 





can be increased upto 850 km using only three concate¬ 
nated swapping setup, which exceeds the achievable dis¬ 
tance for the decoy-state protocol. We have found that 
for superconducting nanowire detectors the achievable 
distance is around 2000 km for TV = 2. Hence, low dark 
count rates and efficient detectors are desirable to deliver 
long-distance quantum communication. However, be¬ 
cause of the probabilistic nature of PDC sources, the key 
rates for the PDC-CES-BBM92 protocol are atrociously 
low. On the other hand, for perfect resources these key 
rates approach closely to the TGW bound so the low rate 
is close to the theoretical maximum for non-quantum- 
repeater-based protocols. Therefore, quantum memories 
are needed to generate higher secret key-generation rates 
for probabilistic sources. For fixed distance, visibility is 
always higher for fewer relays. Our model provides a 
foundation for modeling future setups including all the 
resource imperfections, and an important next step is to 
construct an accurate model for quantum memories and 
quantum repeaters. 
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surement stations give clicks qrst is 


We thank N. Lutkenhaus and E. Zahedinejad for valu¬ 
able discussions and appreciate financial support from 
the 1000 Talent Plan of China and from Alberta Inno¬ 
vates Technology Futures. This research has been en¬ 
abled by the use of computing resources provided by 
WestGrid and Compute/Calcul Canada. 


Appendix A: Coincidence probability for 
PDC-CES-BBM92 setup 

As discussed in Sec. Mil visibility is calculated from co¬ 
incidence probability. Here we briefly explain the method 
to calculate coincidence probability at all 8N detectors. 

At each measurement setup in Fig. [t] there is a four¬ 
tuple of detectors, one for each H mode and the other 
for each V mode after the incident beam passes through 
each PBS. For the sake of simplicity in the calculations, 


Pcoinc =P{q'r's't\qrst) 

= V P(qV a 't'\i'j'k'l') 

i' j' k'l r ,ijkl 
x P(ijkl\qrst ), 


(A4) 


where q = {qiq2 ■ ■ ■ q2N-i} is a binary string with each 
q = 0 representing a no-click and q = 1 represents a click. 
Similar strings for r, s and t exist. 


In Eq. 


Aijkl 

i'j'k'l' 


is the probability that the per¬ 
fect detectors with A would have detected i' and j' pho¬ 
tons and those at B would have detected k' and l ' after 
passing through the polarizer rotators conditioned on de¬ 
tection of ijkl photons at perfect detectors at measure¬ 
ment stations. Here i = (ii« 2 ....* 2 jv-i) for the 2 N — 1 
four-tuple of detectors, and similar strings pertain for j , 
k, and l. Thus, A*^ l kn , is [23| 
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where a and /3 are the angles of the polarizer rotators and the form of k„, jjv+n, k^+n) is analogous, 
at A’s and B’s measurement setup, respectively. We have 
used the expression 


/d-n + An 


^AT+n? ^iV+n) — ^ ^ 


7=0 



^ f N+n lN-\-n \^n 

\ ^N-\-n — 7 
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The closed-form solution for A 2 3 4 5 6 7 8 J^ l kll , (|A5l) provides the 
explicit expression for the probability of detecting the i' 
and j' photons at A and the k' and V photons at B, 
such that ijkl photons are detected at all intermediate 
stations. This expression is used in Eq. (lAdl) to calculate 
the maximum and minimum coincidences in Eq. 0. 
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